The Hacker Who Exposed South Korea’s Deadly Epidemic

Park Sun-yeong was riding the bus to his office in the Seoul suburb of Suwon when South Korea announced the nation’s first fatalities from Middle East respiratory syndrome, known as MERS. The 26-year-old programmer looked down at his phone to read a text message from a friend. It was a list of hospitals to avoid—hospitals rumored to have been visited by people infected with the deadly virus.

That Tuesday morning, June 2, the South Korean government also announced that 25 more people had been infected and 700 were under quarantine. But President Park Geun-hye’s administration was refusing to release the names of the hospitals that the patients had visited. Officials were saying they didn’t want to stoke fear and that they wanted to protect the reputations of the hospitals involved.

A passenger wearing masks to prevent contracting Middle East Respiratory Syndrome (MERS) sits in front of an arrivals signboard at Gimpo International Airport in Seoul, South Korea, June 17, 2015.

The hospital list Park had in his hands had been forwarded to him by a friend who had gotten it from a friend, who had gotten it from a friend, and so on. Where the list originated, no one knew. Park had several more messages like it, each with a slightly different catalog of hospitals approaching two dozen in total. There was no way to know which—if any—of these lists were accurate.

In front of Park on the bus, a man coughed. Several passengers shot him annoyed looks. Another man wore a mask—a common sight in public these days. As they rode in air-conditioned comfort past rolling green hills in the unseasonable June heat, Park thought: maybe he could curate the unofficial lists and map the potentially affected hospitals.

“I just wanted to get this information out there as a good programmer, to help people, and to defuse rumors about the situation,” he says. “I didn’t know that this map would become so powerful or that it would be used to criticize the government or anything like that.”

Patient Zero

In many ways, Seoul is a city-state within South Korea. Half of the nation’s population lives in the metro area, the world’s second largest. A MERS pandemic in such a dense megacity would be a nightmare. But that week, it wasn’t clear what was spreading faster in Seoul—MERS or rumors about the disease.

MERS is a coronavirus, a kind of virus named for the thorny ring of proteins that surrounds it. Under a microscope, they look like the tines of a crown. MERS is thought to have spilled over from camels to humans, and the first case appeared in Jordan in 2012. The virus isn’t particularly contagious—it resides in the lower respiratory tract, which makes it hard for hosts to infect others, generally requiring direct contact with bodily fluids. But there is no known cure for the disease, no vaccine, no specific treatment beyond giving patients oxygen and fluids to help the body fight off the high fever and pneumonia that it brings. MERS has killed nearly 40% of known patients.

The MERS coronavirus under magnification

Korea’s index case occurred a month before Park started receiving the hospital lists on his phone. A 68-year-old Korean businessman had returned from a trip to Saudi Arabia on May 4. A week later he began coughing and had trouble catching his breath—and on May 20, authorities confirmed that he and his wife had been diagnosed with MERS. Five days later, only one additional case had been announced. But on May 26, there were two more, and two days later, two more.

Each day in Seoul brought a steady drip of new cases, increasingly urgent headlines, and growing outrage at a government that seemed incapable of handling the situation. All but a handful of cases of transmission took place at hospitals where a MERS patient had visited. The initial failure of authorities to control the outbreak within hospitals and their taciturn PR strategy would spawn a wave of fear and fury that, at its peak, closed hundreds of schools, emptied public spaces in Seoul, and shattered the public’s faith in the authorities.

The focal point for the anger was the government’s steadfast refusal to name the hospitals that had treated MERS patients. The unconfirmed lists were spreading via KakaoTalk, the ubiquitous Korean messaging app, but their origins remained a mystery. It was these lists that Park set out to map and verify.

Rumors and Truths

As the CEO of a cloud computing startup called Datasquare, Park is one of Seoul’s new generation of tech entrepreneurs. His hero is Elon Musk, and if Musk ever makes it to Mars, Park says he’ll start an interplanetary digital media company and open a bureau on the Red Planet. But his thoughts were closer to home after he scarfed down dinner at a Gangnam noodle house after work that early June day. He was itching to get started on his MERS map. By midnight, he had a rough version of the site. In his excitement, he could barely sleep.

The next morning, he didn’t go into work. He had an idea to try to verify the rumors: a voting system that he hoped would harness the wisdom of the crowd. By lunchtime, it was in a working state: users could up-vote or down-vote each rumored hospital. If a rumor acquired five down votes, it was hidden from the map. There was a “rumor” button and also a “truth” button: pressing this prompted the user to upload a piece of supporting evidence, either a link to a news article or a first person report.

At 4 pm, the site went live at “The map works through tips from all of you,” it said. Three hours later, the site was getting 3,000 visitors per minute. Slowly but surely, user reports began to come in.

The challenge facing Park wasn’t just to identify which hospitals had MERS patients in their beds—it was also to determine which ones the infected patients had visited. For example, Korea’s index patient had gone to four different healthcare facilities before being hospitalized. It was a textbook example of “doctor shopping,” which is a result of the nation’s disorganized referral system where patients rarely default to seeing their primary care physician, says Sung-Han Kim, a researcher at Asan Medical Center in Seoul. Because routine visits are so affordable in Korea’s single-payer health care system, people often go straight to the biggest and most famous hospitals, even for common colds. This in turn leads to overcrowded emergency rooms that force people to continue “shopping” in search of shorter lines.

Around 8 pm, Park’s phone rang. It was a reporter from the cable network JTBC who had tracked down his phone number from his graduate school. Park was caught off guard, even embarrassed by the attention. That night, as the interview requests came in from nearly every major Korean network and newspaper, he started to freak out. He turned down most of them. “The whole situation was very scary to me,” he says. “It was just getting bigger and bigger and bigger. I couldn’t think.”

Park Sun-yeong
Park Sun-yeong takes a break in a Starbucks in Seoul's Gangnam neighborhood.

As the news stories went live, it became clear that only some of the reporters had figured out who Park was. He read the stories nervously: some were painting him as an anonymous hero, a data vigilante fighting the government. Others were skeptical, asking how collecting rumors in one place made them any more trustworthy.

By Thursday, in the wake of the first round of news stories, MERS Map traffic picked up to 10,000 visits per minute, overloading the server. He needed to scale, and fast. For that, he called in Duhee Lee.

The Korean media calls the 32-year-old Lee a “genius hacker.” In 2006, when he was an undergraduate at the prestigious Seoul National University, he hacked into the school’s computer network to expose its vulnerabilities. Now, he’s the CEO of LikeLion, a nonprofit academy that offers free programming classes to the elite few who are accepted.

Later that day, Lee had a new server up and running. But by then, Park was also working on another problem: the site’s voting mechanism was being overrun by abuse—apparently from people looking to protect the hospitals’ reputations. “Some people were clicking the rumor button every minute,” Park says. “We couldn’t trust everyone.” He decided to scrap the voting system altogether and accept tips only over email. He was going to have to piece together the evidence himself.

Thursday night, the mayor of Seoul, Park Won-soon, called an emergency press conference on national TV and dropped a bombshell: he accused the national health ministry of failing to quarantine a symptomatic doctor who visited a public union meeting, thereby exposing 1,500 people. He slammed the government for hiding this information from the people.

By that time, MERS Map had racked up 2.5 million visitors.


On Friday, June 5, it seemed that President Park’s administration was beginning to reconsider its silence: for the first time, it identified a hospital, Pyeongtaek St. Mary’s, roughly 25 miles south of Seoul, as the epicenter of the initial MERS outbreak where 36 people had caught the virus.

An unusually large cluster from a single case is what epidemiologists call a superspreading event, and it’s not the first time a coronavirus has behaved this way. During the 2003 south China outbreak of SARS (a distant cousin of MERS), the virus propagated through superspreading events on the ninth floor of a Hong Kong hotel, an apartment complex, and an Air China flight to Beijing, among others.

“We still don’t know why,” says Joseph Wu, an epidemiologist at the University of Hong Kong who studied the outbreak in Korea. “Is it because that one case was more infectious? Or is it more environmental factors, like ventilation in the room?” Another wrinkle is that MERS usually requires sustained close contact to spread, but in some cases in Korea, it appears that only one or two minutes were enough to infect another patient. “This is very important scientifically,” Kim says. “We should demonstrate why this kind of unexpected transmission occurred.”

Some investigations in Saudi Arabia, where the virus has been particularly prevalent, give credence to the first hypothesis—that certain patients are more infectious, generating more copies of the virus than others, especially during the early stages of an infection when a patient is first hospitalized.

In Korea, scientists have focused on the latter hypothesis, Kim says. Of the 26 patients who caught MERS directly from the index patient at Pyeongtaek St. Mary’s, 22 of them were in other rooms. An initial experiment conducted in early June in the index patient’s hospital room showed that aerosolized droplets containing the virus—from a sneeze, for example—could hang suspended in the air then rush out on a draft through opened windows and doors.

But even as the government seemed to lift its information embargo ever so slightly, it also announced that it would crack down on people propagating rumors. “Spreading incorrect information and rumors only feeds public fear and confuses people, as well as jeopardizing the government’s efforts to contain the situation,” said the vice minister of justice Kim Joo-hyun, the Korea Times reported. The vice minister didn’t single out MERS Map by name, but the article did, cautioning, “The problem is: No one knows who created the map and there’s no way of knowing if the map contains accurate information.”

Meanwhile, the government’s main opposition party, the New Politics Alliance for Democracy, was trying to co-opt the map’s growing popularity. It announced it was forming a shadow committee to investigate the government’s response, and one of its key proposals was “to cooperate with the citizens behind ‘MERS Map’.”

Park first heard about the opposition party’s plan on the news. The political firestorm was threatening to engulf him, and the thought terrified him. That afternoon, “MERS Map” became the top trending search term in the nation.


With all eyes on him, Park established the criteria for vetting the roughly 100 user reports that had been submitted. First, he would only consider reports that arrived with the submitter’s real name attached to them. Second, to mark a hospital as affected, he needed not one but two pieces of evidence: a news report about a MERS-hit hospital, which redacted the name but typically gave the general location, and a user report submitted from that hospital confirming some detail of the government’s account.

By connecting the dots drawn from user and news reports, Park came up with a list of 14 hospitals that had been visited by confirmed MERS patients. That tally happened to match a government statement, leaving him confident his methodology was working. He even began to receive emails from doctors at professional organizations, submitting not only reports but corrections and confirmations.

A screenshot of MERS Map on June 4

As public trust in MERS Map was growing, faith in the healthcare system was plummeting. One 59-year-old man who gave his family name as Yeo told me of an appointment he kept at hospital in western Seoul that was reportedly MERS-free. He said he was a little worried, but couldn’t put it off—he was having cataract surgery, and needed it done. Weeks later, he found out that a patient with MERS had been hospitalized there at the time of his visit. It had been long enough that he realized—with relief—that he was outside the incubation period. But, he says, “After I saw how Korean hospitals handled MERS, I don’t believe in their ability to handle that kind of contagious disease.”

Even as media reported on Park’s efforts with MERS Map, many of them lauding the site, most outlets declined to print the list themselves. For example, one major broadcaster interviewed Park but blurred screenshots of the map itself.

Self-censorship is not unusual in South Korea: under the nation’s defamation laws, the media can be sued even if they are accurately reporting the truth, limiting the press’s ability to function as a watchdog. “Korea has a crisis of the government using libel laws to suppress the media,” said law professor Park Kyung-shin of Korea University at a journalism conference in Seoul in May. He thinks MERS Map would probably have prevailed in a legal battle by claiming that it was solely for public interest. “However,” he adds, “the risk is not frivolous, which is the very reason that most news agencies refused to publish the names of the hospitals.” In addition, he says, courts grant that defense more readily to major newspapers and broadcasters, but not bloggers or independent voices like MERS Map.

Park may have been emboldened by a lack of familiarity with these laws—he says he didn’t worry too much about legal action. “I didn’t get any phone calls from any hospitals. No one sued me.” He laughs, adding, “I didn’t get any compliments from the hospitals, either.”

No End in Sight

By Saturday, June 6, an eerie calm descended upon Seoul. Under clear blue skies, public plazas and fountains normally full of sightseers and playing children were deserted. That night, clubs in the trendiest neighborhoods of Seoul were only half full—mostly of foreigners. Movie theater attendance plummeted; online book sales rose. Earlier, the government had announced 22 new cases of MERS—the largest single-day jump of the outbreak to date.

If patients were being identified, why wasn’t the outbreak slowing? Perhaps the biggest culprit was cultural, says Kim of Asan Medical Center. In Korea’s healthcare system, family members traditionally carry out the basic care that nurses provide in other countries. Entire families were exposed to MERS as they tended to their relatives.

Reforming the nursing system is an obvious step and a top priority for the government, but it amounts to changing the foundations of the Korean medical system, says Kim. “It’s very complicated,” Kim says. “Our culture, the national health care budget, the economic status of those seeking care—many factors have to be considered.”

Introducing full nursing care means dissuading Koreans from a traditional way of fulfilling a family duty. It also means introducing new degree and certification programs. According to one study, these programs will need to train 50,000 nurses at a cost of $4 billion dollars. Plus, professional bodies of nurses are staunchly opposed, fearing that current nurses with four year degrees will lose their jobs to the flood of newcomers.

Kim also argues that, regardless of the nursing situation, the Korean’s government’s response was too inflexible to deal with a pathogen with so many unknowns. The policy of not naming hospitals might have quelled past public fears about existing, well-understood diseases. “But MERS is a very emerging and new infection. In that kind of infection, transparency is very important,” Kim says.

As the outbreak expanded, Park continued to work around the clock on MERS Map, fielding and sorting reports. He hadn’t slept more than a few hours in the four days since he’d come up with the idea on the bus. By now, his girlfriend, Shim-in Oh, had joined the team, putting aside her own work as a freelance designer and author, as had two of Duhee’s colleagues at LikeLion. The team not only processed reports and tweaked the website, they also gave Park a chance to cope with the pressure.

“I don’t smoke,” he says, almost ruefully. “My mind was unstable.” During a pause, he mentally queries his English vocabulary and dumps the results to make his point: “I was very nervous and excited and scared and worrying.”

And then, on Sunday morning, the government finally caved. Breaking its silence, it released a list of affected hospitals—24 in total. All 14 of the hospitals on MERS Map were on the list. Park had done what he set out to do—separate rumor from fact—and then some.

He doesn’t want to take too much credit for the government’s decision. President Park’s administration was under pressure from many sides, including local authorities who, following the lead of Seoul’s mayor, were demanding information to take their own actions. According to the Ministry of Health and Welfare, the decisive factor was public opinion. “Officially, we did not consider any opinion based on a certain site,” says Park Ki-Soo, the deputy spokesperson for the health ministry. But he allows that “there was a lot of response online,” and that some websites “will have a great effect on the public opinion.”

An Alternate Narrative

Park Sun-yeong pushes back gently against the notion that he was applying pressure on the government, saying that was never his intention. But he’s proud to have helped change officials’ minds and to have gone further in verifying and reporting the information than any professional news organization. “We don’t know exactly, but people trusted this site very well, and there were many visitors,” Park’s girlfriend Oh says. “Maybe all the people in Korea,” she jokes. “Maybe.”

Park and his team’s efforts were certainly noticed by epidemiologists outside of Korea, including researchers at HealthMap, a disease-mapping project at Boston Children’s Hospital. The HealthMap team uses programs that scour the internet for reports from official health agencies, news articles, and social media, and they work with relief agencies and authorities to help guide decision-making, says HealthMap fellow Maimuna Shahnaz Majumder. But she notes that MERS Map demonstrates that “when governments or international organizations like the World Health Organization don’t step in and provide information, the public will find its own way to fill the gaps.”

In that way, MERS Map is reminiscent of efforts by the crisis mapping community, which deploys teams of volunteers when disasters strike to crowdsource the gathering of critical information like hospital status or damage assessment. “We’ve seen that as well in other environments where you’ve got a repressive regime—this idea of being able to create an alternative narrative from that of the state,” says Patrick Meier, who researches digital humanitarianism at the Qatar Computing Research Institute in Doha.

Such talk makes Park extremely uncomfortable. “No no no no no no no,” he says, shaking his head vigorously. “Don’t make him like a hero,” Shim-in Oh tells me. “We’re not anti-government. He’s a programmer, not a political person.”

“In the end, I think that the government changed in a positive way,” says Sung-Han Kim, the Asan Medical Center researcher. “I believe that the current situation is quite transparent.” Overhauling Korea’s health care system will take time, but the government seems to have learned the value of transparency. When the outbreak reached its one-month mark and new cases were subsiding, scientists lauded the quality of data made available by President Park’s administration. “What they put on the web was very, very good,” says Joseph Wu, the Hong Kong epidemiologist. “In terms of mapping out the epidemiology, they did a fabulous job.”

Even after the government officially announced the list of affected hospitals, Park continued to work on the map, iterating and updating it as the government released more information. Then, on Wednesday, June 10, a week after Park launched MERS Map, the government announced that it would create its own web portal. “This was my chance to get out of this situation,” says Park, laughing as he recalls his elation. “You want to get the information, don’t visit my site, go to the government’s site! My turn is over.”

That night, he pulled the site down, posting a simple farewell message on its Facebook page that began: “Hello. We are MERS Map.” It had acquired 5 million users and fielded 340 different reports. It linked to the government’s site and other resources and signed off with the names and roles of everyone involved—the first time the full team had revealed themselves to the nation. Dozens of comments followed, posting, “Su-go man-eu-shyeoss-seum-ni-da.” Thank you for your efforts.

This article is part of the “Next Outbreak” series, a collaboration between NOVA Next and The GroundTruth Project in association with WGBH Boston.